Your Backup Box May Already Be Locked: The Synology Ransomware Wave Hitting Small Offices This Week

Somewhere this week, a small-business owner sat down at their desk, tried to open a client file, and found it renamed .L0CK3D — along with a note directing them to a dark-web portal to buy a decryptor. Their Synology network-attached storage device, the box that likely holds their shared files, backups, and project folders, had been silently encrypted overnight.

This is not a hypothetical. It is happening right now, to businesses like yours.

What Just Happened

On November 2, 2026, Synology — the Taiwanese company whose network-attached storage (NAS) devices sit in hundreds of thousands of small offices worldwide — issued an urgent warning to its customers. A ransomware strain called C3RB3R (a variant of the older Cerber family) is actively targeting Synology NAS appliances that have not been updated. Synology warned customers to update their devices immediately due to a surge in C3RB3r ransomware attacks, urging users to enable automatic updates and upgrade the DiskStation Manager (DSM) software running on their NAS devices.

The particularly aggravating detail here: Synology fixed the flaw in December 2024, and the attackers in November 2026 are collecting from devices that never received the fix. This is not a sophisticated zero-day attack. It is opportunistic harvesting of devices that were simply never updated.

C3RB3R ransomware has been observed locking users' files with a ".L0CK3D" extension. The group has encrypted files on hundreds of Synology NAS devices worldwide, demanding 0.037 bitcoin from each victim with no working decryptor available. There is currently no way to get your files back without either paying the ransom — which security professionals universally advise against — or restoring from a separate, unaffected backup.

Why a Synology Box Is So Common — and So Targeted

A Synology NAS (network-attached storage) device is a small appliance, often the size of a hardback book, that plugs into your office router and acts as a shared file server. Small businesses use them for shared drives, automated backups, and media storage. They are affordable, well-regarded, and genuinely useful. Wirecutter described Synology as a "longtime leader in the small-business and home NAS arena."

That popularity is precisely what makes them a target. Many home and small-business users expose the DiskStation Manager (DSM) management interface directly to the internet for remote access, and internet scanning by the Shadowserver Foundation tracks more than 380,000 Synology NAS devices reachable online. Attackers do not need to pick their victims individually — they scan the whole internet, find every exposed Synology device running an outdated version, and hit them in bulk.

The Flaw, in Plain English

The core vulnerability being exploited — tracked as CVE-2024-10441, using the Common Vulnerabilities and Exposures (CVE) numbering system — carries a severity score of 9.8 out of 10. That bug lets a remote attacker run code on the NAS without needing a username or password. The attacker finds your device on the internet, sends a specially crafted request, and gains full control. Files get encrypted. The ransom note appears. Work stops.

Researchers at Qihoo 360 Internet Security Center also tied the campaign to two additional vulnerabilities disclosed in 2026. Attackers leveraged two newly disclosed 2026 DSM vulnerabilities — CVE-2026-13684 and CVE-2026-13639, both rated 9.8 — affecting SCGI and login logic, enabling arbitrary file read/write and denial-of-service. In practice, the attackers are chaining whatever unpatched flaw they find; the result for the victim is the same regardless of which one opens the door.

One more wrinkle worth knowing: DSM's automatic updates do not upgrade across major versions, and there have been reports of older devices being shown as on the "latest version" — meaning a DSM update is necessary but not sufficient on its own to guarantee safety. Your device may tell you it is up to date when it is not.

What Version You Actually Need

Synology has published the specific software builds that close the known vulnerabilities. The protected releases are: DSM 7.2.2 build 72806-1 or later; DSM 7.2.1 build 69057-6 or later; DSM 7.2 build 64570-4 or later; DSM 7.1 build 42962-7 or later; and DSM 6.2 build 25556-8 or later. If your device is running anything older than these, it is exposed.

Not all internet-exposed devices run vulnerable versions, but any device that has not taken an update since 2024 is a target.

The Honest Severity Read

This is not a background noise threat. Active exploitation is confirmed and ongoing. The ransom demand is currently set in bitcoin, there is no free decryptor, and Synology lists no mitigation other than updating. If your NAS is exposed to the internet on an outdated DSM version, the question is not whether it will be found — it is whether it has been found already.

The good news: unlike many security problems, this one has a clear and complete fix. Update the software. Remove unnecessary internet exposure. Verify your backups are stored somewhere separate from the NAS itself.

What This Means for Your Business — and What to Do

If you have a Synology device in your office and an IT provider or managed service provider (MSP) managing it, the conversation is short and specific. If you manage it yourself, the action is equally direct — but you need to log in and check.

Here are the questions to bring to your IT provider this week:

• Do we have a Synology NAS, and if so, what DSM version is it running? You need a version number, not a reassurance.
• Is the DSM management interface exposed directly to the internet? If yes, ask them to close that access and configure a VPN (virtual private network) or Synology's own relay service for remote access instead. NAS owners are advised to immediately block access to the management web interface from the internet.
• Where are our backups stored? If the only backup is on the Synology device itself, an attack encrypts both your working files and your recovery copy simultaneously. You need a backup that is physically or logically separate — ideally both.
• Can you confirm the device is on one of Synology's patched builds, with the specific build number? "It looks fine" is not an answer. The build number is.
• Are automatic updates enabled — and do they actually cover major version upgrades? As noted above, they may not.

The core lesson here is not unique to Synology. Attackers are patient. They wait for the gap between when a patch is released and when it is installed, then work that gap at scale. Nearly two years passed between Synology's fix and this ransomware wave. That gap is entirely closable. It just requires someone actually checking.

Your IT provider's job is to close gaps like this before attackers find them. This week, check that they have.